Call recording is leverage: better coaching, faster onboarding, cleaner handoffs, and the raw material for every revenue intelligence feature your team will eventually want. It is also a legal and ethical surface where mistakes are expensive. This guide walks you through the full setup inside a modern CRM: wiring the dialer, surfacing the consent screen, picking a retention window that holds up to audit, routing transcripts to the right records, and building the coaching tags that turn raw audio into a feedback loop. The goal is a recording stack reps trust and a legal team signs off on, in one build.
Time: 120 minutes
Before you enable a single recording, pull the states and countries every rep calls into over the last ninety days and classify each one as one-party or two-party consent. One-party means a single participant on the call can authorize the recording. Two-party, more accurately all-party, means every participant must give informed consent before you may lawfully capture audio. The federal baseline in the United States is one-party, but a dozen states including California, Florida, Illinois, Massachusetts, Pennsylvania, and Washington require all-party consent. The European Union, United Kingdom, and most of Canada require all-party consent as a floor. The practical consequence is that if you have reps in or calling into any all-party jurisdiction, you must build to the stricter standard everywhere. Mixed policies create training burden and audit risk you do not want. Write the map down, get a legal signoff on the summary, and store it in the same workspace where you keep your data processing agreements. That document is your north star for every setting that follows.
Call recording lives at the intersection of three systems: the dialer or meeting platform that captures audio, the CRM record it attaches to, and the storage layer that holds the file. Start by connecting the dialer first, because without the right telephony integration you will spend the rest of the build chasing missing recordings. Most modern CRMs offer native connectors for the common dialers plus a webhook pathway for anything custom. Install the connector under a service account, not a personal one, so the integration does not break when an admin leaves. Verify that the connector pulls three things on every call: the audio file itself, the call metadata (duration, participants, direction, outcome), and the recording consent timestamp. If any of those three fields are missing, stop and fix the integration before you move on. A recording with no consent timestamp is unusable in a dispute, and metadata gaps make coaching queries hollow.
Consent has two surfaces: the moment a prospect first interacts with your dialer or booking link, and the opening seconds of the call itself. On the first surface, add a short notice to your booking page and any inbound IVR that calls may be recorded for training and quality purposes, including a plain-language link to your privacy policy. On the second surface, the rep delivers a one-sentence announcement before any substantive conversation: "I want to let you know this call is being recorded for coaching and quality purposes. Is that okay with you?" Pause for a verbal yes before continuing. Script it, train it, and store the exact wording in your CRM playbook so compliance can audit against it. For all-party jurisdictions, verbal consent is legally required; do not treat it as optional. For one-party jurisdictions you can skip the question in theory, but running one script everywhere is simpler, builds trust, and keeps your training burden flat. The six seconds you spend asking will not cost you a deal. The six-figure settlement from a non-consenting call will.
Retention is the single most important compliance decision in the whole build and the one most often skipped. Pick a default retention window that matches your actual business need and legal obligations: ninety days for most B2B coaching use cases, up to seven years if the recording feeds a regulated contract trail. Shorter is almost always safer. The GDPR, CCPA, and most state privacy laws require that personal data, which recorded voice is, be retained only as long as necessary for the stated purpose. "Forever" is not a stated purpose. Build the policy in the CRM as an automated purge: every recording older than the retention window is deleted on a scheduled job, with a tamper-evident log of what was deleted and when. Add a legal-hold flag that admins can set on individual recordings to pause the purge during active disputes. Document the policy, get it signed by legal, link to it from the privacy policy, and treat any change to the window as a material privacy update that requires a new round of consent language.
A recording stuck in a telephony silo is a liability. A recording automatically threaded onto the right opportunity, contact, and account is an asset. Configure the integration to look up the inbound or outbound phone number against the CRM, find the matching contact, and attach the audio, transcript, and metadata to that contact and any related open opportunity. If the number does not match an existing contact, route the recording to a review queue rather than orphaning it. Transcripts, in particular, should land on the opportunity timeline alongside emails and meetings so a rep or manager can read the room without hunting across tools. For calls with multiple participants, resolve each speaker to a CRM contact where possible and tag unresolved speakers as external participants rather than guessing. The payoff compounds: once transcripts live on the record, every downstream feature from search to AI summarization gets dramatically more useful without any extra work.
Raw transcripts without structure are a graveyard. Coaching tags are the structure that turns audio into a feedback loop. Build a short, flat taxonomy of five to eight tags that map to the moments your managers actually coach on: discovery depth, next-step clarity, objection handling, pricing confidence, technical accuracy, competitor mention, champion identification, and risk flag. More than eight and nobody remembers them. Fewer than five and the signal is too coarse. Each tag is applied to a specific moment in the recording, not to the whole call, so managers can jump straight to the thirty seconds that matter. Let reps self-tag their own calls as part of their weekly workflow and let managers add tags during review. Store tags as structured data linked to a timestamp range on the recording, which makes them queryable, dashboardable, and training data for any future AI coaching model. Resist the urge to spin up a tag for every edge case. Tag taxonomies that bloat past ten tags die the same quarter they are introduced.
Recordings are personal data about both your prospects and your own reps. Lock down access with the same seriousness you would apply to compensation records. Build three distinct permissions in the CRM: listen, download, and delete. Reps can listen to their own calls and the calls their manager assigns for coaching. Managers can listen to any call for reps in their reporting line. Download should be rare and logged, limited to legal, compliance, and the recording owner. Delete should be rarer still, limited to admins acting on a documented legal hold release or a verified data subject request. Every listen, download, and delete event writes to an immutable audit log that compliance can query. Do not let the dialer platform export recordings outside this permissions model; if the connector surfaces recordings in a separate console with its own permissions, you have two sources of truth and a compliance gap. Collapse everything into one permissions model under the CRM.
The best recording stack in the world is wasted if nobody listens. Build a review cadence that uses recordings instead of just storing them. The baseline cadence that works for most sales teams is three calls per rep per week reviewed by their manager, with written feedback captured against the coaching tags from the previous step. Set up a dashboard that shows review coverage per rep, average time to first review, and the top three coaching tags per rep per month. The dashboard is the forcing function; without it the cadence quietly drops to zero by the second month. Make the review itself asynchronous where possible. A manager leaves a short written note tied to a timestamp, the rep responds in the same thread, and the exchange lives on the recording. Live listening sessions still matter for new hires and for difficult deals, but asynchronous review scales where live sessions do not. Track whether coaching feedback actually changes rep behavior by comparing tags before and after a coaching intervention. If the ratios do not shift, the coaching is not working.
Resist the temptation to flip recording on company-wide the day the integration is live. Pilot with one team of three to six reps for a full month. During the pilot, measure three things: consent-capture rate (should be above ninety-eight percent), transcript routing accuracy (above ninety-five percent of calls hitting the correct contact), and review cadence (every rep getting at least three calls reviewed per week). If any number falls short, fix the gap before you expand. During the pilot, also capture rep feedback on the consent script, the review workflow, and the tag taxonomy. The reps will spot every awkward phrase and every missing permission before any dashboard will. Only after a clean pilot month do you roll out to the full org, and even then stage it by team over two to four weeks rather than all at once. A staged rollout gives you a safety valve: if any team hits a compliance snag you can pause that cohort without disabling recording for everyone. Call it the quietest high-leverage launch your revenue team will do this year.
Legally, only a dozen states and most of Europe and Canada require all-party consent. Operationally, running one script everywhere is simpler than training reps on a jurisdiction map and switching consent prompts by phone number. Build to the stricter standard, ask every participant for verbal consent, and store the response as structured data. The extra six seconds is cheaper than the training burden of a mixed policy.
Ninety days is a defensible baseline for coaching and quality use cases, and it aligns with the data minimization principle in GDPR and most state privacy laws. Longer windows are justifiable only when the recording feeds a regulated contract trail or an active dispute. If your legal team cannot explain why you need more than ninety days, default to ninety and extend by exception with a legal-hold flag.
Three realistic options: the CRM vault, an S3 bucket under your own account with encryption keys you manage, or a third-party revenue intelligence platform. For most teams, the CRM vault is simplest and aligns permissions with the rest of your data. S3 under your own keys is the right call if you have strict data residency requirements. Third-party platforms make sense when you want packaged AI coaching features and are comfortable adding another processor to your DPA.
Stop the recording immediately, note the decline on the call record as structured data, and continue the conversation without audio. Do not try to convince the prospect to change their mind, and never continue recording after a decline. Train reps that a decline is a routine outcome, not a lost deal signal. Many prospects will accept recording when the rep explains it is for internal coaching, not for distribution. Those who still decline deserve a frictionless yes-we-can-still-talk response.
Generally no. Internal coaching, pipeline reviews, and strategy calls between employees carry the same consent requirements as external calls in most jurisdictions, with the added complexity that candid internal feedback is harder to capture when people know it is on tape. If you do record internal calls, treat them under the same policy and permissions model as external calls, with the same retention window and audit log.
Under GDPR and CCPA, a data subject access request can include every recording and transcript where the requester is identifiable, including recordings where they are a non-primary participant. Design the storage layer so you can query by phone number or email and export or delete all matching recordings and transcripts within the legally mandated window (thirty days under GDPR, forty-five days under CCPA). If your retention policy and permissions model are tight, this is a routine query. If storage is scattered across the dialer, CRM, and a third-party platform, it is a month of panic every time a request lands.
Reassign ownership of their recordings to their manager or the account owner so the audit trail stays complete, and revoke the departing rep listen access on their last day. Do not delete the recordings on exit; they are the company property under the retention policy. Only the automated purge job or a documented data subject request should trigger deletion. The audit log should reflect the ownership change so compliance can reconstruct who had access when.
Strkr wires the dialer, consent capture, transcript routing, retention automation, and coaching tags into one permissions model your legal team can actually sign off on. Build once, pilot cleanly, scale without panic.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
